Idea2Strategy · kcrmin · Aug 9, 2026 · Aug 9, 2026
diff --git a/db/canonical-baseline/R__database_runtime_grants.sql b/db/canonical-baseline/R__database_runtime_grants.sql
@@ -336,7 +336,7 @@ GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."password_reset_request
 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."policy_documents" TO idea2strategy_backend;
 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."recovery_code_sets" TO idea2strategy_backend;
 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."recovery_codes" TO idea2strategy_backend;
-GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."sessions" TO idea2strategy_backend;
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE "identity"."refresh_token_families" TO idea2strategy_backend;
 GRANT SELECT ON TABLE "market_data"."corporate_actions" TO idea2strategy_backend;
 GRANT SELECT ON TABLE "market_data"."dataset_lineage" TO idea2strategy_backend;
 GRANT SELECT ON TABLE "market_data"."dataset_manifests" TO idea2strategy_backend;
@@ -454,11 +454,11 @@ GRANT SELECT ON TABLE "backtest"."monthly_judgment_summaries" TO idea2strategy_b
 GRANT SELECT ON TABLE "backtest"."performance_summaries" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "backtest"."run_attempts" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "backtest"."run_input_pins" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "backtest"."runs" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "backtest"."runs" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "bot"."bot_events" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "bot"."bot_partitions" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "bot"."bots" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "bot"."continuation_deadlines" TO idea2strategy_batch;
+GRANT SELECT, UPDATE ON TABLE "bot"."bots" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "bot"."continuation_deadlines" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "bot"."evaluation_runs" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "bot"."flow_feature_requirements" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "bot"."flow_instruments" TO idea2strategy_batch;
@@ -474,20 +474,20 @@ GRANT SELECT ON TABLE "competition"."backtest_evaluation_periods" TO idea2strate
 GRANT SELECT ON TABLE "competition"."backtest_evaluation_plans" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."backtest_period_datasets" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."backtest_period_feature_materializations" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."backtest_period_runs" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "competition"."backtest_period_runs" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."leaderboard_entries" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."leaderboard_snapshots" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."live_evaluation_segments" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "competition"."live_evaluation_segments" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."live_room_rules" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."participation_events" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."participations" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "competition"."participation_events" TO idea2strategy_batch;
+GRANT SELECT, UPDATE ON TABLE "competition"."participations" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."room_evaluation_account_results" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."room_events" TO idea2strategy_batch;
+GRANT SELECT, INSERT ON TABLE "competition"."room_events" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."room_final_access_grants" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."room_invitations" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."room_rules" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."room_schedules" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "competition"."rooms" TO idea2strategy_batch;
+GRANT SELECT, UPDATE ON TABLE "competition"."rooms" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "competition"."scoring_template_versions" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "identity"."account_closure_readiness" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "identity"."account_closure_runs" TO idea2strategy_batch;
@@ -525,7 +525,7 @@ GRANT SELECT ON TABLE "identity"."password_reset_requests" TO idea2strategy_batc
 GRANT SELECT ON TABLE "identity"."policy_documents" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "identity"."recovery_code_sets" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "identity"."recovery_codes" TO idea2strategy_batch;
-GRANT SELECT ON TABLE "identity"."sessions" TO idea2strategy_batch;
+GRANT SELECT ON TABLE "identity"."refresh_token_families" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "market_data"."corporate_actions" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "market_data"."dataset_lineage" TO idea2strategy_batch;
 GRANT SELECT ON TABLE "market_data"."dataset_manifests" TO idea2strategy_batch;
@@ -755,6 +755,8 @@ GRANT SELECT, INSERT, UPDATE ON TABLE "backtest"."performance_summaries" TO idea
 GRANT SELECT, INSERT, UPDATE ON TABLE "backtest"."run_attempts" TO idea2strategy_backtest;
 GRANT SELECT, INSERT, UPDATE ON TABLE "backtest"."run_input_pins" TO idea2strategy_backtest;
 GRANT SELECT, INSERT, UPDATE ON TABLE "backtest"."runs" TO idea2strategy_backtest;
+GRANT SELECT ON TABLE "bot"."bots" TO idea2strategy_backtest;
+GRANT SELECT ON TABLE "bot"."launch_contract_plans" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."corporate_actions" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."dataset_lineage" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."dataset_manifests" TO idea2strategy_backtest;
@@ -771,6 +773,8 @@ GRANT SELECT ON TABLE "market_data"."providers" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."quality_incidents" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."stream_watermarks" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "market_data"."trading_sessions" TO idea2strategy_backtest;
+GRANT SELECT, INSERT, UPDATE ON TABLE "operations"."outbox_consumer_receipts" TO idea2strategy_backtest;
+GRANT SELECT ON TABLE "operations"."outbox_messages" TO idea2strategy_backtest;
 GRANT SELECT, INSERT ON TABLE "storage"."objects" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "strategy"."compiled_flow_plans" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "strategy"."element_catalog_versions" TO idea2strategy_backtest;
@@ -784,7 +788,9 @@ GRANT SELECT ON TABLE "strategy"."template_versions" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "strategy"."templates" TO idea2strategy_backtest;
 GRANT SELECT ON TABLE "strategy"."validation_runs" TO idea2strategy_backtest;
 GRANT USAGE ON SCHEMA "backtest" TO idea2strategy_backtest;
+GRANT USAGE ON SCHEMA "bot" TO idea2strategy_backtest;
 GRANT USAGE ON SCHEMA "market_data" TO idea2strategy_backtest;
+GRANT USAGE ON SCHEMA "operations" TO idea2strategy_backtest;
 GRANT USAGE ON SCHEMA "storage" TO idea2strategy_backtest;
 GRANT USAGE ON SCHEMA "strategy" TO idea2strategy_backtest;
 GRANT SELECT, INSERT, UPDATE ON TABLE "market_data"."corporate_actions" TO idea2strategy_pipeline;

diff --git a/db/canonical-baseline/V20260805170000__backtest_run_outcome_detail.sql b/db/canonical-baseline/V20260805170000__backtest_run_outcome_detail.sql
@@ -0,0 +1,35 @@
+-- backtest: forward adoption of the approved run outcome projection.
+--
+-- The earlier V20260802143000 proposal was authored before newer central Flyway
+-- history. It is preserved under fixtures/superseded-proposals for audit, but is
+-- deliberately outside the active contribution directory. This globally ordered
+-- forward version is the only bundle-eligible outcome migration.
+--
+-- Scope is intentionally limited to the three outcome fields already consumed by
+-- the runtime. In particular this migration does not restore the retired legacy
+-- input-pin fields dataset_manifest_id, dataset_hash, or
+-- feature_materialization_version.
+
+ALTER TABLE "backtest"."runs"
+  ADD COLUMN "result_manifest_id" uuid,
+  ADD COLUMN "retryable" boolean,
+  ADD COLUMN "missing_requirements" jsonb;
+
+-- backtest.v1 requires UNAVAILABLE.missingRequirements to be a non-empty array
+-- of strings. NULL remains valid for every status where the field is not
+-- applicable. retryable intentionally has no default: "not failed" and
+-- "failed, not retryable" are different facts.
+ALTER TABLE "backtest"."runs"
+  ADD CONSTRAINT "runs_missing_requirements_is_a_non_empty_string_array"
+  CHECK (
+    "missing_requirements" IS NULL
+    OR (
+      jsonb_typeof("missing_requirements") = 'array'
+      AND jsonb_array_length("missing_requirements") > 0
+      AND NOT jsonb_path_exists("missing_requirements", '$[*] ? (@.type() != "string")')
+    )
+  );
+
+COMMENT ON COLUMN "backtest"."runs"."result_manifest_id" IS 'COMPLETED resultManifestId linking the run to its immutable result manifest; NULL for other states.';
+COMMENT ON COLUMN "backtest"."runs"."retryable" IS 'FAILED retryable decision; NULL when the run has not failed.';
+COMMENT ON COLUMN "backtest"."runs"."missing_requirements" IS 'UNAVAILABLE missingRequirements as the non-empty ordered string array received from the worker; NULL for other states.';
diff --git a/db/canonical-baseline/V20260806100000__backend_google_oidc_provider.sql b/db/canonical-baseline/V20260806100000__backend_google_oidc_provider.sql
@@ -0,0 +1,8 @@
+INSERT INTO identity.auth_providers (id, code, display_name, provider_type, issuer, is_active)
+VALUES (3, 'GOOGLE', 'Google', 'OIDC', 'https://accounts.google.com', true)
+ON CONFLICT (code) DO UPDATE
+SET display_name = EXCLUDED.display_name,
+    provider_type = EXCLUDED.provider_type,
+    issuer = EXCLUDED.issuer,
+    is_active = true,
+    updated_at = now();
diff --git a/db/canonical-baseline/V20260806120000__pipeline_seed_official_feature_output_feed.sql b/db/canonical-baseline/V20260806120000__pipeline_seed_official_feature_output_feed.sql
@@ -0,0 +1,69 @@
+-- Forward-only adoption of contract.market-data.publication.v1 revision 2.
+-- Existing rows are accepted only when every protected identity field matches.
+DO $migration$
+DECLARE
+    rsi_parameters jsonb := '{"period":14,"price_field":"close","method":"SIMPLE_AVERAGE_BOUNDED_WINDOW","input_adjustment":"SPLIT_DIVIDEND_ADJUSTED","calendar_id":"XNYS"}'::jsonb;
+BEGIN
+    IF EXISTS (SELECT 1 FROM market_data.feature_definitions WHERE id = '0f1b0000-0000-4000-8000-000000000001') THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM market_data.feature_definitions
+            WHERE id = '0f1b0000-0000-4000-8000-000000000001'
+              AND element_catalog_version_id = '0f1a0000-0000-4000-8000-000000000001'
+              AND feature_code = 'RSI_14' AND calculator_version = 'rsi:1.0.0'
+              AND resolution = '1m' AND normalized_parameters = rsi_parameters
+              AND output_value_type = 'NUMBER' AND required_history_points = 15
+              AND definition_hash = 'sha256:1a7c3e5b9d2f4068a1c3e5b7d9f20416283a5c7e9b1d3f50627496a8c0e2b4d6'
+        ) THEN
+            RAISE EXCEPTION 'official RSI_14 definition identity drift';
+        END IF;
+    ELSE
+        INSERT INTO market_data.feature_definitions (
+            id, element_catalog_version_id, feature_code, calculator_version, resolution,
+            normalized_parameters, output_value_type, required_history_points, definition_hash, created_at
+        ) VALUES (
+            '0f1b0000-0000-4000-8000-000000000001', '0f1a0000-0000-4000-8000-000000000001',
+            'RSI_14', 'rsi:1.0.0', '1m', rsi_parameters, 'NUMBER', 15,
+            'sha256:1a7c3e5b9d2f4068a1c3e5b7d9f20416283a5c7e9b1d3f50627496a8c0e2b4d6',
+            TIMESTAMPTZ '2026-08-04 00:00:00+00'
+        );
+    END IF;
+
+    IF EXISTS (SELECT 1 FROM market_data.providers WHERE id = 'b9146ed9-dbb0-5323-93e3-8518f3851236') THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM market_data.providers
+            WHERE id = 'b9146ed9-dbb0-5323-93e3-8518f3851236'
+              AND code = 'IDEA2STRATEGY_INTERNAL'
+              AND display_name = 'Idea2Strategy Derived Data'
+              AND rights_version = 'internal-derived-v1' AND status = 'ACTIVE'
+        ) THEN
+            RAISE EXCEPTION 'IDEA2STRATEGY_INTERNAL provider identity drift';
+        END IF;
+    ELSE
+        INSERT INTO market_data.providers (id, code, display_name, rights_version, status, created_at)
+        VALUES ('b9146ed9-dbb0-5323-93e3-8518f3851236', 'IDEA2STRATEGY_INTERNAL',
+                'Idea2Strategy Derived Data', 'internal-derived-v1', 'ACTIVE',
+                TIMESTAMPTZ '2026-08-06 12:00:00+00');
+    END IF;
+
+    IF EXISTS (SELECT 1 FROM market_data.feeds WHERE id = '063f8f27-5c6a-5348-b2bb-abc3c634149c') THEN
+        IF NOT EXISTS (
+            SELECT 1 FROM market_data.feeds
+            WHERE id = '063f8f27-5c6a-5348-b2bb-abc3c634149c'
+              AND provider_id = 'b9146ed9-dbb0-5323-93e3-8518f3851236'
+              AND code = 'FEATURE_RSI_14_1M_RSI_1_0_0' AND data_kind = 'FEATURE_SERIES'
+              AND resolution = '1m' AND timezone_name = 'UTC'
+              AND feed_version = 'rsi-1.0.0+feature-series.parquet.v1' AND retired_at IS NULL
+        ) THEN
+            RAISE EXCEPTION 'official RSI_14 feature feed identity drift';
+        END IF;
+    ELSE
+        INSERT INTO market_data.feeds (
+            id, provider_id, code, data_kind, resolution, timezone_name, feed_version, created_at, retired_at
+        ) VALUES (
+            '063f8f27-5c6a-5348-b2bb-abc3c634149c', 'b9146ed9-dbb0-5323-93e3-8518f3851236',
+            'FEATURE_RSI_14_1M_RSI_1_0_0', 'FEATURE_SERIES', '1m', 'UTC',
+            'rsi-1.0.0+feature-series.parquet.v1', TIMESTAMPTZ '2026-08-06 12:00:00+00', NULL
+        );
+    END IF;
+END
+$migration$;
diff --git a/db/canonical-baseline/V20260807120000__backend_customer_refresh_token_families.sql b/db/canonical-baseline/V20260807120000__backend_customer_refresh_token_families.sql
@@ -0,0 +1,87 @@
+CREATE TABLE identity.refresh_token_families (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    account_id uuid NOT NULL,
+    authenticated_by_login_identity_id uuid NOT NULL,
+    auth_epoch_at_issue bigint NOT NULL,
+    credential_version_at_issue bigint,
+    current_token_digest varchar(128) NOT NULL UNIQUE,
+    digest_key_version smallint NOT NULL,
+    issued_at timestamptz NOT NULL DEFAULT now(),
+    last_rotated_at timestamptz NOT NULL,
+    expires_at timestamptz NOT NULL,
+    revoked_at timestamptz,
+    revoke_reason_code varchar(80),
+    CONSTRAINT refresh_token_family_auth_epoch_positive CHECK (auth_epoch_at_issue > 0),
+    CONSTRAINT refresh_token_family_credential_version_positive
+        CHECK (credential_version_at_issue IS NULL OR credential_version_at_issue > 0),
+    CONSTRAINT refresh_token_family_digest_key_version_positive CHECK (digest_key_version > 0),
+    CONSTRAINT refresh_token_family_time_order_valid
+        CHECK (last_rotated_at >= issued_at AND expires_at > last_rotated_at),
+    CONSTRAINT refresh_token_family_login_identity_fk
+        FOREIGN KEY (account_id, authenticated_by_login_identity_id)
+        REFERENCES identity.login_identities (account_id, id)
+);
+
+CREATE INDEX refresh_token_families_account_expiry_idx
+    ON identity.refresh_token_families (account_id, expires_at);
+CREATE INDEX refresh_token_families_account_revoked_idx
+    ON identity.refresh_token_families (account_id, revoked_at);
+
+INSERT INTO identity.refresh_token_families (
+    id,
+    account_id,
+    authenticated_by_login_identity_id,
+    auth_epoch_at_issue,
+    credential_version_at_issue,
+    current_token_digest,
+    digest_key_version,
+    issued_at,
+    last_rotated_at,
+    expires_at,
+    revoked_at,
+    revoke_reason_code
+)
+SELECT
+    id,
+    account_id,
+    authenticated_by_login_identity_id,
+    auth_epoch_at_issue,
+    credential_version_at_issue,
+    token_digest,
+    digest_key_version,
+    issued_at,
+    last_seen_at,
+    expires_at,
+    revoked_at,
+    revoke_reason_code
+FROM identity.sessions;
+
+ALTER TABLE strategy.strategy_edit_leases
+    ADD COLUMN account_id uuid;
+
+UPDATE strategy.strategy_edit_leases lease
+SET account_id = session.account_id
+FROM identity.sessions session
+WHERE lease.session_id = session.id;
+
+ALTER TABLE strategy.strategy_edit_leases
+    DROP CONSTRAINT strategy_edit_leases_session_id_fkey,
+    DROP CONSTRAINT strategy_edit_lease_exactly_one_editor,
+    DROP COLUMN session_id,
+    ADD CONSTRAINT strategy_edit_lease_exactly_one_editor
+        CHECK (
+            (account_id IS NOT NULL AND delegated_credential_id IS NULL)
+            OR (account_id IS NULL AND delegated_credential_id IS NOT NULL)
+        ),
+    ADD CONSTRAINT strategy_edit_leases_account_id_fkey
+        FOREIGN KEY (account_id) REFERENCES identity.accounts (id);
+
+DROP TABLE identity.sessions;
+
+ALTER TABLE identity.account_security_states
+    RENAME COLUMN sessions_revoked_before TO credentials_revoked_before;
+
+COMMENT ON TABLE identity.refresh_token_families IS
+    'Minimal server state for rotating refresh JWT reuse detection. It is not a device session registry and has no concurrent-login policy.';
+COMMENT ON TABLE strategy.strategy_edit_leases IS
+    'Allows exactly one active editor. Customer leases are account-owned and independently protected by the lease token; refresh token families are not editor identities.';